iamdoubz
ba293f8703
Owner decisions 2026-10-25: a user connects their OpenID account and signs in with either it or their password; the admin picks passwords only, OpenID only (admins keep a password way in), or mixed. No automatic accounts. OIDC sessions re-checked every 15 min with the refresh token; signing out also signs out at the provider; password sign-ins keep two-step. LDAP is one more way to check a password. Decision 0004: openid-client and ldapts. Tasks S1-S5.
899 B
0004 — openid-client and ldapts for single sign-on
Owner, 2026-10-25: sign-in with an OpenID Connect provider and with an LDAP directory (spec 12).
Both protocols are security code we must not write ourselves: OIDC needs PKCE, state/nonce, ID
token signature and claim checks, iss response checks and JWKS rotation; LDAP needs BER encoding,
StartTLS and RFC 4515 filter escaping. openid-client 6.x (panva, MIT) is the reference
certified OpenID relying party library for Node; its only dependencies, oauth4webapi and jose,
are the same author's and MIT. ldapts (MIT, TypeScript, promise API) is the maintained LDAP
client (ldapjs was decommissioned in 2024) and has escapeFilter. Both are open source with no
native code. No OIDC test server is added: the tests use a small fake provider on node:http
and node:crypto, and live tests run against a real Keycloak and lldap.